Users of web applications are identified by session IDs. An attacker can impersonate users when generated sessions are predictable. This article introduces Burp Suite Sequencer and shows how it can be used to analyze session randomness.

2. Burp Suite Sequencer

The sequencer is part of Burp Suite, which is an integrated platform for web site security testing [1]. Burp Suite Sequencer is helpful when analyzing session randomness.

Let’s describe how to perform this analysis. The penetration tester intercepts the request (with Burp Suite Proxy) for which the response includes the session ID. Then the request is sent to Burp Suite Sequencer. After that, the penetration tester needs to choose the field in the response for which randomness will be analyzed (session ID in this example). Burp Suite Sequencer is launched. At least 100 requests need to be sent so that Burp Suite Sequencer can perform the analysis.

3. Target

DVWA (Damn Vulnerable Web Application) is a web application that is intentionally vulnerable [2]. It is helpful for those who want to play with web application security stuff. DVWA is part of Metasploitable.

Metasploitable is a Linux-based virtual machine that is intentionally vulnerable [3]. It can be used, for example, to practice penetration testing skills. Please remember that this machine is vulnerable and should not operate in bridge mode.

This article shows how to analyze the randomness of session IDs generated by DVWA.

4. Request Interception

When the penetration tester visits DVWA for the first time, the following request is sent (intercepted with Burp Suite Proxy).

Let’s analyze the response to this request.

As we can see, the cookie with PHPSESSID is set. Now the penetration tester is going to send the request many times and analyze the values of PHPSESSID in the responses. There is no need to do it manually. It can be done automatically with Burp Suite Sequencer.

5. Sending Request to Burp Suite Sequencer

Right-click right on the intercepted request with Burp Suite Proxy and choose “Send to Sequencer.”

6. Launching Burp Suite Sequencer

The penetration tester wants to check the randomness of PHPSESSID in the response. That’s why he needs to choose it in “Token Location Within Response.” Then click “Start live capture” to launch Burp Suite Sequencer.

7. Burp Suite Sequencer—Analyzing Randomness of PHPSESSID

When this tool has been launched, requests are sent and values of PHPSESSID are analyzed in the responses. The analysis can start after 100 requests (“Analyze now” button).

As we can see, the section “Overall result” shows information about the randomness of PHPSESSID within the sample of 189 requests. One can save the values of PHPSESSID to a file (“Save tokens” button; the result is shown below).

8. Summary

The attacker can impersonate a user when generated sessions are predictable. This article introduced Burp Suite Sequencer and showed how to use this tool to analyze session randomness. Another application of Burp Suite Sequencer could be, for example, randomness analysis of the CSRF token.

Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.
Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing services with a results-driven approach. He also works as Security Architect at Future Processing.
Dawid shares his bug hunting experience in his workshop entitled "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more". To find out about the latest in Dawid's work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).

About InfoSec

InfoSec Institute is the best source for high quality information security training. We have been training Information Security and IT Professionals since 1998 with a diverse lineup of relevant training courses. In the past 16 years, over 50,000 individuals have trusted InfoSec Institute for their professional development needs!

Join our newsletter

File download

First Name

Last Name

Work Phone Number

Work Email Address

Job Title

How will you fund your training?

Why Take This Training?

What is your timeline for training?

InfoSec institute respects your privacy and will never use your personal information for anything other than to notify you of your requested course pricing. We will never sell your information to third parties. You will not be spammed.

Comments

What is Skillset?

Skillset

Practice tests & assessments.

Practice for certification success with the Skillset library of over 100,000 practice test questions. We analyze your responses and can determine when you are ready to sit for the test. Along your journey to exam readiness, we will:

1. Determine which required skills your knowledge is sufficient
2. Which required skills you need to work on
3. Recommend specific skills to practice on next
4. Track your progress towards a certification exam